Analysis
-
max time kernel
58s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
14/10/2022, 10:30
General
-
Target
b504bc57bfe2a1fe0cd9003c9a83af156b71da659547276fb22ef5a07b398685.exe
-
Size
2.0MB
-
MD5
6a9ecae73e03c232e6a8a2fd7721aadb
-
SHA1
ccb49814d1d47518383d07479683cc3d4d86e8df
-
SHA256
b504bc57bfe2a1fe0cd9003c9a83af156b71da659547276fb22ef5a07b398685
-
SHA512
54eab337adf92625c90c5b429f08cb41ac40ed8aa4d44f6f008a086e691f856dd45a7cbfd7464cd39d9808b012c248a2af23e12ea8d1cd96c3b9e12498b6022d
-
SSDEEP
24576:yDyTFtjBDyTFtjsDyTFtjBDyTFtjmDyTFtjBDyTFtjtDyTFtjBDyTFtjsDyTFtjB:/tqthtqtHtqt+tqthtqtHtqt
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 64 IoCs
-
Drops file in System32 directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Modifies registry class 57 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b504bc57bfe2a1fe0cd9003c9a83af156b71da659547276fb22ef5a07b398685.exe"C:\Users\Admin\AppData\Local\Temp\b504bc57bfe2a1fe0cd9003c9a83af156b71da659547276fb22ef5a07b398685.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7082258.exeC:\Users\Admin\AppData\Local\Temp\tmp7082258.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7083552.exeC:\Users\Admin\AppData\Local\Temp\tmp7083552.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7083521.exeC:\Users\Admin\AppData\Local\Temp\tmp7083521.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7082429.exeC:\Users\Admin\AppData\Local\Temp\tmp7082429.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7082850.exeC:\Users\Admin\AppData\Local\Temp\tmp7082850.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7082601.exeC:\Users\Admin\AppData\Local\Temp\tmp7082601.exe3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 361⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\tmp7083771.exeC:\Users\Admin\AppData\Local\Temp\tmp7083771.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7085596.exeC:\Users\Admin\AppData\Local\Temp\tmp7085596.exe3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7085284.exeC:\Users\Admin\AppData\Local\Temp\tmp7085284.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7087375.exeC:\Users\Admin\AppData\Local\Temp\tmp7087375.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\tmp7088420.exeC:\Users\Admin\AppData\Local\Temp\tmp7088420.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\tmp7088669.exeC:\Users\Admin\AppData\Local\Temp\tmp7088669.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\tmp7089028.exeC:\Users\Admin\AppData\Local\Temp\tmp7089028.exe9⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7089137.exeC:\Users\Admin\AppData\Local\Temp\tmp7089137.exe9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7091009.exeC:\Users\Admin\AppData\Local\Temp\tmp7091009.exe10⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"11⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7091805.exeC:\Users\Admin\AppData\Local\Temp\tmp7091805.exe12⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7092086.exeC:\Users\Admin\AppData\Local\Temp\tmp7092086.exe12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7092507.exeC:\Users\Admin\AppData\Local\Temp\tmp7092507.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7093022.exeC:\Users\Admin\AppData\Local\Temp\tmp7093022.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"16⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7093817.exeC:\Users\Admin\AppData\Local\Temp\tmp7093817.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"18⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7094863.exeC:\Users\Admin\AppData\Local\Temp\tmp7094863.exe19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7095253.exeC:\Users\Admin\AppData\Local\Temp\tmp7095253.exe19⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7096423.exeC:\Users\Admin\AppData\Local\Temp\tmp7096423.exe20⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7100775.exeC:\Users\Admin\AppData\Local\Temp\tmp7100775.exe22⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7103224.exeC:\Users\Admin\AppData\Local\Temp\tmp7103224.exe24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7103552.exeC:\Users\Admin\AppData\Local\Temp\tmp7103552.exe24⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7104254.exeC:\Users\Admin\AppData\Local\Temp\tmp7104254.exe25⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7105970.exeC:\Users\Admin\AppData\Local\Temp\tmp7105970.exe27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7106204.exeC:\Users\Admin\AppData\Local\Temp\tmp7106204.exe27⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7106625.exeC:\Users\Admin\AppData\Local\Temp\tmp7106625.exe28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7106999.exeC:\Users\Admin\AppData\Local\Temp\tmp7106999.exe28⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7105049.exeC:\Users\Admin\AppData\Local\Temp\tmp7105049.exe25⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7102148.exeC:\Users\Admin\AppData\Local\Temp\tmp7102148.exe22⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7102959.exeC:\Users\Admin\AppData\Local\Temp\tmp7102959.exe23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7103614.exeC:\Users\Admin\AppData\Local\Temp\tmp7103614.exe23⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7099652.exeC:\Users\Admin\AppData\Local\Temp\tmp7099652.exe20⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7094379.exeC:\Users\Admin\AppData\Local\Temp\tmp7094379.exe17⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7095237.exeC:\Users\Admin\AppData\Local\Temp\tmp7095237.exe18⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7096844.exeC:\Users\Admin\AppData\Local\Temp\tmp7096844.exe20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7099667.exeC:\Users\Admin\AppData\Local\Temp\tmp7099667.exe20⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7100728.exeC:\Users\Admin\AppData\Local\Temp\tmp7100728.exe21⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7102491.exeC:\Users\Admin\AppData\Local\Temp\tmp7102491.exe23⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7103942.exeC:\Users\Admin\AppData\Local\Temp\tmp7103942.exe25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7105003.exeC:\Users\Admin\AppData\Local\Temp\tmp7105003.exe25⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\tmp7105767.exeC:\Users\Admin\AppData\Local\Temp\tmp7105767.exe26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7106469.exeC:\Users\Admin\AppData\Local\Temp\tmp7106469.exe26⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7103365.exeC:\Users\Admin\AppData\Local\Temp\tmp7103365.exe23⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7104020.exeC:\Users\Admin\AppData\Local\Temp\tmp7104020.exe24⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7105471.exeC:\Users\Admin\AppData\Local\Temp\tmp7105471.exe26⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7106687.exeC:\Users\Admin\AppData\Local\Temp\tmp7106687.exe28⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7108169.exeC:\Users\Admin\AppData\Local\Temp\tmp7108169.exe30⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7108809.exeC:\Users\Admin\AppData\Local\Temp\tmp7108809.exe30⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7109433.exeC:\Users\Admin\AppData\Local\Temp\tmp7109433.exe31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7109714.exeC:\Users\Admin\AppData\Local\Temp\tmp7109714.exe31⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7107015.exeC:\Users\Admin\AppData\Local\Temp\tmp7107015.exe28⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7108185.exeC:\Users\Admin\AppData\Local\Temp\tmp7108185.exe29⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7109090.exeC:\Users\Admin\AppData\Local\Temp\tmp7109090.exe31⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7110026.exeC:\Users\Admin\AppData\Local\Temp\tmp7110026.exe33⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7110541.exeC:\Users\Admin\AppData\Local\Temp\tmp7110541.exe35⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7110775.exeC:\Users\Admin\AppData\Local\Temp\tmp7110775.exe35⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7112693.exeC:\Users\Admin\AppData\Local\Temp\tmp7112693.exe36⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"37⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\tmp7113863.exeC:\Users\Admin\AppData\Local\Temp\tmp7113863.exe38⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7114628.exeC:\Users\Admin\AppData\Local\Temp\tmp7114628.exe40⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"41⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\tmp7115330.exeC:\Users\Admin\AppData\Local\Temp\tmp7115330.exe42⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7116360.exeC:\Users\Admin\AppData\Local\Temp\tmp7116360.exe44⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7116828.exeC:\Users\Admin\AppData\Local\Temp\tmp7116828.exe44⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7117171.exeC:\Users\Admin\AppData\Local\Temp\tmp7117171.exe45⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7117452.exeC:\Users\Admin\AppData\Local\Temp\tmp7117452.exe45⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7115642.exeC:\Users\Admin\AppData\Local\Temp\tmp7115642.exe42⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7116126.exeC:\Users\Admin\AppData\Local\Temp\tmp7116126.exe43⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"44⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\tmp7117015.exeC:\Users\Admin\AppData\Local\Temp\tmp7117015.exe45⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7117966.exeC:\Users\Admin\AppData\Local\Temp\tmp7117966.exe47⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7119464.exeC:\Users\Admin\AppData\Local\Temp\tmp7119464.exe47⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7119963.exeC:\Users\Admin\AppData\Local\Temp\tmp7119963.exe48⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7120369.exeC:\Users\Admin\AppData\Local\Temp\tmp7120369.exe48⤵
- Drops file in System32 directory
- Modifies registry class
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7117264.exeC:\Users\Admin\AppData\Local\Temp\tmp7117264.exe45⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7117920.exeC:\Users\Admin\AppData\Local\Temp\tmp7117920.exe46⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7119760.exeC:\Users\Admin\AppData\Local\Temp\tmp7119760.exe48⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7120728.exeC:\Users\Admin\AppData\Local\Temp\tmp7120728.exe50⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7121367.exeC:\Users\Admin\AppData\Local\Temp\tmp7121367.exe52⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7122397.exeC:\Users\Admin\AppData\Local\Temp\tmp7122397.exe54⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7122678.exeC:\Users\Admin\AppData\Local\Temp\tmp7122678.exe54⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7123770.exeC:\Users\Admin\AppData\Local\Temp\tmp7123770.exe55⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7125158.exeC:\Users\Admin\AppData\Local\Temp\tmp7125158.exe57⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7126141.exeC:\Users\Admin\AppData\Local\Temp\tmp7126141.exe57⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7127451.exeC:\Users\Admin\AppData\Local\Temp\tmp7127451.exe58⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7127919.exeC:\Users\Admin\AppData\Local\Temp\tmp7127919.exe58⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7123926.exeC:\Users\Admin\AppData\Local\Temp\tmp7123926.exe55⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7121695.exeC:\Users\Admin\AppData\Local\Temp\tmp7121695.exe52⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7122100.exeC:\Users\Admin\AppData\Local\Temp\tmp7122100.exe53⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7123161.exeC:\Users\Admin\AppData\Local\Temp\tmp7123161.exe55⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7123504.exeC:\Users\Admin\AppData\Local\Temp\tmp7123504.exe55⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7125033.exeC:\Users\Admin\AppData\Local\Temp\tmp7125033.exe56⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7127264.exeC:\Users\Admin\AppData\Local\Temp\tmp7127264.exe58⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7128309.exeC:\Users\Admin\AppData\Local\Temp\tmp7128309.exe58⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7128902.exeC:\Users\Admin\AppData\Local\Temp\tmp7128902.exe59⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7129183.exeC:\Users\Admin\AppData\Local\Temp\tmp7129183.exe59⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7125330.exeC:\Users\Admin\AppData\Local\Temp\tmp7125330.exe56⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7122490.exeC:\Users\Admin\AppData\Local\Temp\tmp7122490.exe53⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7120977.exeC:\Users\Admin\AppData\Local\Temp\tmp7120977.exe50⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7121742.exeC:\Users\Admin\AppData\Local\Temp\tmp7121742.exe51⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7122724.exeC:\Users\Admin\AppData\Local\Temp\tmp7122724.exe53⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7123988.exeC:\Users\Admin\AppData\Local\Temp\tmp7123988.exe55⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"56⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7124284.exeC:\Users\Admin\AppData\Local\Temp\tmp7124284.exe55⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7126188.exeC:\Users\Admin\AppData\Local\Temp\tmp7126188.exe56⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7128668.exeC:\Users\Admin\AppData\Local\Temp\tmp7128668.exe58⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7129370.exeC:\Users\Admin\AppData\Local\Temp\tmp7129370.exe60⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7130259.exeC:\Users\Admin\AppData\Local\Temp\tmp7130259.exe62⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7130368.exeC:\Users\Admin\AppData\Local\Temp\tmp7130368.exe62⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7130727.exeC:\Users\Admin\AppData\Local\Temp\tmp7130727.exe63⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7131055.exeC:\Users\Admin\AppData\Local\Temp\tmp7131055.exe63⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7186170.exeC:\Users\Admin\AppData\Local\Temp\tmp7186170.exe62⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7129744.exeC:\Users\Admin\AppData\Local\Temp\tmp7129744.exe60⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7129978.exeC:\Users\Admin\AppData\Local\Temp\tmp7129978.exe61⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7130696.exeC:\Users\Admin\AppData\Local\Temp\tmp7130696.exe63⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7131226.exeC:\Users\Admin\AppData\Local\Temp\tmp7131226.exe65⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7132147.exeC:\Users\Admin\AppData\Local\Temp\tmp7132147.exe67⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7132849.exeC:\Users\Admin\AppData\Local\Temp\tmp7132849.exe67⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7133488.exeC:\Users\Admin\AppData\Local\Temp\tmp7133488.exe68⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7135345.exeC:\Users\Admin\AppData\Local\Temp\tmp7135345.exe70⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7136062.exeC:\Users\Admin\AppData\Local\Temp\tmp7136062.exe72⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7136671.exeC:\Users\Admin\AppData\Local\Temp\tmp7136671.exe72⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7138293.exeC:\Users\Admin\AppData\Local\Temp\tmp7138293.exe73⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7138465.exeC:\Users\Admin\AppData\Local\Temp\tmp7138465.exe73⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7135594.exeC:\Users\Admin\AppData\Local\Temp\tmp7135594.exe70⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7135766.exeC:\Users\Admin\AppData\Local\Temp\tmp7135766.exe71⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7138137.exeC:\Users\Admin\AppData\Local\Temp\tmp7138137.exe73⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7138948.exeC:\Users\Admin\AppData\Local\Temp\tmp7138948.exe75⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7139978.exeC:\Users\Admin\AppData\Local\Temp\tmp7139978.exe77⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7140368.exeC:\Users\Admin\AppData\Local\Temp\tmp7140368.exe77⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7140618.exeC:\Users\Admin\AppData\Local\Temp\tmp7140618.exe78⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7141366.exeC:\Users\Admin\AppData\Local\Temp\tmp7141366.exe80⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7143457.exeC:\Users\Admin\AppData\Local\Temp\tmp7143457.exe82⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7144268.exeC:\Users\Admin\AppData\Local\Temp\tmp7144268.exe84⤵
- Drops file in System32 directory
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7144658.exeC:\Users\Admin\AppData\Local\Temp\tmp7144658.exe84⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7146000.exeC:\Users\Admin\AppData\Local\Temp\tmp7146000.exe85⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7146920.exeC:\Users\Admin\AppData\Local\Temp\tmp7146920.exe87⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7148199.exeC:\Users\Admin\AppData\Local\Temp\tmp7148199.exe89⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7148917.exeC:\Users\Admin\AppData\Local\Temp\tmp7148917.exe91⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7149775.exeC:\Users\Admin\AppData\Local\Temp\tmp7149775.exe91⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7150929.exeC:\Users\Admin\AppData\Local\Temp\tmp7150929.exe92⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7151616.exeC:\Users\Admin\AppData\Local\Temp\tmp7151616.exe92⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7148465.exeC:\Users\Admin\AppData\Local\Temp\tmp7148465.exe89⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7149011.exeC:\Users\Admin\AppData\Local\Temp\tmp7149011.exe90⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7149900.exeC:\Users\Admin\AppData\Local\Temp\tmp7149900.exe92⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7151054.exeC:\Users\Admin\AppData\Local\Temp\tmp7151054.exe94⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7151569.exeC:\Users\Admin\AppData\Local\Temp\tmp7151569.exe94⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\tmp7153254.exeC:\Users\Admin\AppData\Local\Temp\tmp7153254.exe95⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7154159.exeC:\Users\Admin\AppData\Local\Temp\tmp7154159.exe97⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7155344.exeC:\Users\Admin\AppData\Local\Temp\tmp7155344.exe99⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7157996.exeC:\Users\Admin\AppData\Local\Temp\tmp7157996.exe101⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7158885.exeC:\Users\Admin\AppData\Local\Temp\tmp7158885.exe101⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\tmp7160570.exeC:\Users\Admin\AppData\Local\Temp\tmp7160570.exe102⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7161959.exeC:\Users\Admin\AppData\Local\Temp\tmp7161959.exe102⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7156561.exeC:\Users\Admin\AppData\Local\Temp\tmp7156561.exe99⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7157481.exeC:\Users\Admin\AppData\Local\Temp\tmp7157481.exe100⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7160477.exeC:\Users\Admin\AppData\Local\Temp\tmp7160477.exe102⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"103⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\tmp7161787.exeC:\Users\Admin\AppData\Local\Temp\tmp7161787.exe104⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7167777.exeC:\Users\Admin\AppData\Local\Temp\tmp7167777.exe106⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7171740.exeC:\Users\Admin\AppData\Local\Temp\tmp7171740.exe108⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7175094.exeC:\Users\Admin\AppData\Local\Temp\tmp7175094.exe110⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7177059.exeC:\Users\Admin\AppData\Local\Temp\tmp7177059.exe110⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7179103.exeC:\Users\Admin\AppData\Local\Temp\tmp7179103.exe111⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7182270.exeC:\Users\Admin\AppData\Local\Temp\tmp7182270.exe113⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7184594.exeC:\Users\Admin\AppData\Local\Temp\tmp7184594.exe115⤵
- Drops file in System32 directory
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7186139.exeC:\Users\Admin\AppData\Local\Temp\tmp7186139.exe115⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7188260.exeC:\Users\Admin\AppData\Local\Temp\tmp7188260.exe116⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7188650.exeC:\Users\Admin\AppData\Local\Temp\tmp7188650.exe116⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7183050.exeC:\Users\Admin\AppData\Local\Temp\tmp7183050.exe113⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7184126.exeC:\Users\Admin\AppData\Local\Temp\tmp7184126.exe114⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7185140.exeC:\Users\Admin\AppData\Local\Temp\tmp7185140.exe114⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7180850.exeC:\Users\Admin\AppData\Local\Temp\tmp7180850.exe111⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7172005.exeC:\Users\Admin\AppData\Local\Temp\tmp7172005.exe108⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7176498.exeC:\Users\Admin\AppData\Local\Temp\tmp7176498.exe109⤵
- Drops file in System32 directory
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7177153.exeC:\Users\Admin\AppData\Local\Temp\tmp7177153.exe109⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7170741.exeC:\Users\Admin\AppData\Local\Temp\tmp7170741.exe106⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7172395.exeC:\Users\Admin\AppData\Local\Temp\tmp7172395.exe107⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7179337.exeC:\Users\Admin\AppData\Local\Temp\tmp7179337.exe109⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7181053.exeC:\Users\Admin\AppData\Local\Temp\tmp7181053.exe109⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7183612.exeC:\Users\Admin\AppData\Local\Temp\tmp7183612.exe110⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7185328.exeC:\Users\Admin\AppData\Local\Temp\tmp7185328.exe112⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7186934.exeC:\Users\Admin\AppData\Local\Temp\tmp7186934.exe114⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7189789.exeC:\Users\Admin\AppData\Local\Temp\tmp7189789.exe116⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7190772.exeC:\Users\Admin\AppData\Local\Temp\tmp7190772.exe116⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7191989.exeC:\Users\Admin\AppData\Local\Temp\tmp7191989.exe117⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7193206.exeC:\Users\Admin\AppData\Local\Temp\tmp7193206.exe119⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7194781.exeC:\Users\Admin\AppData\Local\Temp\tmp7194781.exe121⤵
- Drops file in System32 directory
- Modifies registry class
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-